<html>Hello everybody!<br /><br />I have a problem with DNS-RPZ and forward zone working together.<br />I've created a rpz zone with the following trigger on my recursive DNS Server:<br />18.0.0.198.200.rpz-nsip IN CNAME rpz-passthru.<br /><br />It means any query response comming from a DNS Server which IP address matching with the any IP address at entire CIDR block 200.198.0.0/18 will be answered with rpz-passthru <br />It works perfectly for any domain hosted in my Authoritative DNS Servers.<br />But when I apply on my recursive RPZ DNS Server a forward zone for those domains hosted on my Authoritative DNS Servers the problems appear and it is very weird.<br /><br />I have a mg.gov.br domain and its NS Servers are zeus.prodemge.gov.br (200.198.5.13), titanio.prodemge.gov.br (200.198.5.5), tupan.prodemge.gov.br (200.198.4.4) and jupiter.prodemge.gov.br (200.198.5.2).<br />If I perform a dig at my workstation using Recursive DNS with RPZ looking for any record in mg.gov.br domain, rpz-passthru policy is not applied, however if I perform a dig looking for any record in prodemge.gov.br domain and after that I perform the same dig before it works properly.<br /><br /><br />Note: Recursive DNS Servers and Authoritative DNS Servers are not the same.<br /><br />As workaround solution I applied 4 rpz-nsdname triggers above that one mentioned in the begining this email with my authoritative name servers with rpz-passthru policy.<br />titanio.prodemge.gov.br.rpz-nsdname IN CNAME rpz-passthru.<br />jupiter.prodemge.gov.br.rpz-nsdname IN CNAME rpz-passthru.<br />tupan.prodemge.gov.br.rpz-nsdname IN CNAME rpz-passthru.<br />zeus.prodemge.gov.br.rpz-nsdname IN CNAME rpz-passthru.<br /><br />I would like to understand why it didn't work without workaround solution, anyone has any idea about it?<br /><br />Thanks in advance<br />--<br /><br /><font size="3"><b>Miguel Moreira</b><br />Gerente</font><br /><font size="3">DPR/SRE/GSR - Gerência de Serviços de Rede<br />+55(31)3339-1401<br />PRODEMGE - Companhia de Tecnologia da Informação do Estado de Minas Gerais</font><br /><br /><br /><font size="2">Aviso: Esta mensagem é destinada exclusivamente para a(s) pessoa(s) a quem é dirigida, podendo conter informação sigilosa e legalmente protegida. O uso impróprio será tratado conforme as normas da empresa e a legislação em vigor. Caso não seja o destinatário, favor notificar o remetente, ficando proibidas a utilização, divulgação, cópia e distribuição.</font></html>